Bluekit PhaaS fast-flux domain: browser process connecting to 5+ IPs for same domain in 1h

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects potential fast-flux DNS behavior indicative of Bluekit PhaaS P2P infrastructure. The rule monitors for browser processes resolving a single domain to 5 or more distinct external IP addresses within a one-hour window, excluding known CDNs and cloud infrastructure.